Immuta Extends Its Authorization Layer Into Teradata AI Studio for Agentic Data Access

AI agents are moving from pilots into the daily operations of the enterprise, and more of them are being built where the data already lives. For Teradata customers, that place is increasingly Teradata AI Studio, where Tera, Teradata’s agentic coworker, works directly against governed enterprise data.

That shift makes one question more important than any other: what should an agent be allowed to do with the data, and on whose behalf? Answering it is the job of data authorization, and it is why Immuta is deliberately building a deeper integration with Teradata AI Studio.

In February, we added attribute-based access control (ABAC) to Teradata, enforced natively at the row and column level. Today we’re building on that foundation in two ways. First, we are extending Immuta into Teradata AI Studio with three Tera skills: one to author policies, one to handle data request workflows and one to prove compliance through Comply. Second, we are adding Agentic OBO support to Teradata, so agents are treated as first-class identities and we can begin to control what agents do on Teradata.

Why go deeper with Teradata AI Studio

Teradata AI Studio is built on a principle we share: data stays in Teradata. Queries run where the data lives, under the platform’s access controls. That makes those controls the most important part of any agent architecture. If they are static, role-based and designed only for humans, every agent either inherits too much access or gets too little to be useful.

As our CTO, Steve Touw, described in Beyond the Prompt, most enterprise agent deployments today fall into one of two risky patterns: shared service accounts that erase the identity of the person asking, or impersonation that hands an agent every standing privilege its user holds. The target state is different: a first-class agent identity, combined just in time with the context of the person it serves, with zero standing privileges. Our work with Teradata is about making that target state the default in Teradata AI Studio.

What we’re adding

Tera skills powered by Immuta

Tera picks up new capabilities through skills. We are adding Immuta’s functionality to three of them, so the people responsible for data can do their part without ever leaving Teradata AI Studio

• Policy authoring and enforcement. Immuta’s policy-based access control (PBAC) comes into Tera. Data owners and stewards author policies where they already work, and Teradata enforces them natively on every query, filtering rows and masking sensitive columns for people and agents alike, on the same ABAC foundation we added in February.
• Data request workflows. When a question needs data a user can’t see yet, Tera raises the request in the conversation, with the purpose, regulation and duration attached. Policy approves routine requests automatically, routes the rest to the right reviewer, and makes every grant time-bound.
• Proof of compliance with Comply. Governance and audit teams can prove compliance from the same environment. Comply shows the policies, approvals and access activity behind every decision, including who asked, which agent acted and what was accessed.

Agentic OBO on Teradata

Agentic OBO support makes agents first-class identities on Teradata. Today, most agents reach data through a shared service account or by borrowing a person’s login, so the database can’t tell an agent apart from anyone else. With Agentic OBO, short for on-behalf-of, each agent has its own identity, and every request it makes is decided on behalf of a specific person: what that person is entitled to, what the agent is permitted to do and what the task requires.

That is how we begin to control agents on Teradata. Access is granted just in time, covers only what all three allow and disappears when the work is done. Every query is attributable to both the agent and the person it served, and there are no standing privileges for an attacker to harvest.

How it fits together

The integration follows the same separation Steve outlined between the control plane and the data plane. Tera plans the work and asks for access in Teradata AI Studio. Immuta makes the authorization decision. Teradata enforces it natively in the data plane, so the data never passes through Immuta and nothing is copied.

Because policies are enforced inside Teradata, they apply consistently to every person and every agent, in the cloud and on premises.

See it in action

In our demo, an analyst asks Tera which merchant categories have the highest fraud rate. Tera discovers she doesn’t have access, files the request in the chat, and policy approves it automatically for one hour. The answer comes back from Teradata with customer details masked. When she needs names to notify affected customers, a reviewer grants a one-hour exception that expires on its own. Two governed decisions, and no tickets.

What it means for Teradata customers

• Agents in production, not just pilots. Authorization keeps pace with agents, so teams can put them to work on sensitive data with confidence.
• Agents you can see and control. Every agent is a first-class identity on Teradata, so security teams know which agent did what, and for whom.
• Zero standing privileges. Access is granted just in time for a specific purpose and removed automatically, so nothing accumulates.
• One policy model for humans and agents. The same PBAC policies govern analysts, applications and agents, without a role for every combination.
• Compliance you can prove. Every decision and every query is recorded with the purpose behind it and the identities involved.
• Data stays in Teradata. Enforcement is native, so there is no proxy in the query path and no copies to manage.

Availability

Immuta’s Teradata integration is available in public preview today, with subscription policies, row filtering and NULL column masking on Teradata views, in the cloud and on premises. The Tera skills and Agentic OBO support described here extend it into Teradata AI Studio and to the agents running on Teradata. See the Teradata integration, or talk to us about bringing it to your environment.

Conclusion: Authorization where agents work

Agents are only as trustworthy as the access they are given. By extending Immuta’s authorization layer into Teradata AI Studio and making agents first-class identities on Teradata, we are making sure every question is authorized, every query is controlled and every agent is accountable, wherever Teradata customers put agents to work.